skills.rest
langbyyi
langbyyiCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

insecure-source-code-management

Detect exposed .git, .svn, .hg metadata and backup files on web applications.

96|1|Updated Jun 4, 2026
Search Tags:#vulnerability assessment#security testing#credential exposure#git exposure#source code leak#backup artifact#svn exposure
One-click install
npx skills add https://github.com/langbyyi/CyberStrikeAI-SRC --skill insecure-source-code-management-langbyyi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: insecure-source-code-management
Source: https://github.com/langbyyi/CyberStrikeAI-SRC/tree/main/skills/insecure-source-code-management
Command: npx skills add https://github.com/langbyyi/CyberStrikeAI-SRC --skill insecure-source-code-management-langbyyi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

During authorized security assessments, exposed version control metadata, backup files, and configuration artifacts can leak sensitive data including source code, credentials, and internal infrastructure details, which is time-consuming and error-prone to manually detect across all common paths and version control system types.

Core Features & Use Cases

  • Multi-VCS Exposure Detection: Identifies exposed .git, .svn, .hg, and .bzr metadata across common web-accessible paths.
  • Backup & Config Leak Scanning: Probes for common backup archives, .env files, and misconfigured server artifacts that may contain sensitive data.
  • Guided Recovery Workflows: Provides step-by-step instructions and open source tool recommendations to safely extract exposed data during authorized assessments. Use Case: For example, during a web application penetration test, use this skill to quickly check for exposed .git directories and .env files that could reveal database credentials or proprietary source code.

Quick Start

Use the insecure-source-code-management skill to scan the target web application for exposed version control metadata, backup files, and configuration leaks during your authorized security assessment.

Frequently Asked Questions about insecure-source-code-management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect exposed .git directories and source code leaks during a penetration test?▼

Backup artifact and config leak scanning identifies exposed backup archives, .env files, and misconfigured server artifacts. By probing common paths for these files, you can discover leaked credentials, source code, and internal infrastructure details during security testing.

What is the best way to extract exposed .svn or .git metadata from a web application?▼

The best way to extract exposed .svn or .git metadata is by using guided recovery workflows with open source extraction tools. This skill provides step-by-step instructions for safely recovering exposed version control data and backup artifacts during authorized assessments.

Does this vulnerability assessment method work for finding exposed .env files and database credentials?▼

You can use this skill to scan the target web application for exposed version control metadata, backup files, and configuration leaks during your authorized security assessment. It supports multi-VCS exposure detection for .git, .svn, .hg, and .bzr paths.

Why should I check for exposed version control metadata in red teaming engagements?▼

Backup artifact and config leak scanning identifies exposed backup archives, .env files, and misconfigured server artifacts. By probing common paths for these files, you can discover leaked credentials, source code, and internal infrastructure details during security testing.

Related Skills

Explore More Software Engineering Skills→
lNwNllNwNl
2

insecure-source-code-management

Detect exposed version-control metadata and backup artifacts during authorized security testing.

Community
Intermediate
infantesromeroadrianinfantesromeroadrian

pentest-ad-attacker

Execute Active Directory attacks and credential access techniques with Impacket, CrackMapExec, and Certipy.

Community
Advanced
uphiagouphiago
1.1k

google-dorks-catalog

Identify exposed configuration files and credentials using pre-validated Google dork queries.

Community
Intermediate
uphiagouphiago
1.1k

hunt-source-leak

Detect exposed source code and build artifacts during web reconnaissance.

Community
Advanced